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Abstract 

The effects of dispersion in the communication channel on the secrecy of a quantum 
cryptosystem based on single photon states with different frequencies are studied. A 
maximum communication channel length which can still ensure the secrecy of the key 
generation procedure is found. 

PACS numbers: 03.65.Bz, 89.70.+C, 42.50.Wm 

The main purpose of cryptography is to allow the exchange of secret information among 
two or more legitimate users. The basic element of every cryptosystem is the key, i.e. a random 
sequence of units and zeros used to code the messages [1]. The communication can be shown 
to be absolutely secret if the key length equals the message length and the key is used only 
once [2]. Therefore, the major task is to ensure the secrecy of the key distribution procedure 
among the legitimate users. In the standard cryptosystem there is no fundamental principle 
which could guarantee the detection of any eavesdropping attempt at the key distribution stage; 
thus the cryptosystem secrecy is based on the key complexity rather than fundamental laws of 
nature [1]. 

On the other hand, quantum cryptography provides a key distribution procedures where 
the possibility of detecting any eavesdropping attempt is guaranteed by the fundamental laws 
of quantum mechanics. 

As a rule, the secrecy of quantum cryptosystems is proved for ideal communication channels. 
However, the imperfections of a communication channel should generally reduce the secrecy of 
the key generation procedure so that any practical cryptosystem should carefully take into 
account the actual properties of the communication channel employed. 

Recently, several new quantum cryptosystems have been proposed [3-9]. One of these 
systems, based on phase coding and employing a 30 km long fiber line as an interferometer arm 
has been realized experimentally [9]. 

In the paper [10] a quantum cryptosystem based on the EPR (Einstein-Podolsky-Rosen) 
effect for biphoton states has been proposed. Actually, a similar scheme can be implemented 
with single-photon states, which is much simpler from the experimental point of view since 
it does not involve generation of biphoton states (e.g., with the parametric down-conversion). 
In addition, such a scheme should be much more stable, since it does not employ a long-arm 
interferometer. 

The secrecy of this cryptosystem (detection of eavesdropping attempts) is based on the 
fundamental time-energy uncertainty relation. The scheme proposed in [10] did not take into 
account attenuation and dispersion in the communication channel which could severely hamper 
its practical realization. The purpose of the present paper is to find out the conditions under 
which it is possible to ensure the secrecy of the cryptosystem in the presence of attenuation 
and dispersion. 

Let us first describe the key generation procedure which does not involve the biphoton states. 
The user A sends at random into the communication channel (optical fiber) to user B on of 
the following three single-photon states: one of the two states with narrow frequency spectra 
centered around well defined frequencies ui and U2 (frequency spectra widths o"i, o"2 <^ ^721) 
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or a well localized in time (correspondingly, with a wide frequency spectrum of width a^) at a 
carry frequency uo ~ 001^2- Actually, the optical fiber transparency window corresponds to the 
wavelength A ~ 1.3 (frequencies u;o,i,2 ~ 10^^ 

According to the fundamental time-energy uncertainty relation, sending a signal with a 
well-defined frequency uji or UJ2 means that the moments of times when the photon leaves user 
A (tA) and is registered by user B (tg) exhibit a large scatter AtA,B > ^/'^i,2- 

If a broad-spectrum photon is emitted, although the associated uncertainty in frequency 
(Too is large, the corresponding state can be prepared rather fast and the photon emission and 
detection times can be measured with high accuracy {At ~ l/cr^ — > if a^o — > 00). 

To register a photon, user B choses randomly and independently of user A in each mea- 
surement either one of the narrow-band photodetectors with central frequencies cui and 002 and 
bandwidths 71,2 ~ o"i,2, or a wide-band photodctector with the central frequency uq and band- 
width 7oo ~ Coo- The frequency separation 60012 = \uji — should not be less than the sum 
(Ji -|- (72 if the photons with frequencies uji and LV2 should be distinguished. For a gaussian 
spectrum the inequality 6uJi2 > 3(o"i + (72) is sufficient. 

Measurements with a narrow-band photodctector allow to distinguish between cui and 002, 
but they cannot be performed in a time shorter than l/5u!i2 (the same is also true for the 
minimal time required to prepare these states). 

Measurements with a wide-band photodctector can be completed during the time interval 
At 00 ~ l/c"oo — 0, but they cannot determine the photon energy with the accuracy better than 
(Too. Users A and B choose the cryptosystem parameters to satisfy the inequality 

Atoo < Ati2. (1) 

After a series of measurements user B announces through a public channel which type of 
the photodctector (wide- or narrow-band) was used in each measurement, but does not disclose 
which particular frequency cui or 002) was used in the case of a narrow-band photodctector. 
Those measurements where the photodctector did not fire or the photodctector type differed 
from the type of the single-photon signal, are discarded. The remaining measurements where 
narrow-band photodetectors were used yield a random sequence of zeros and units (c^i corre- 
sponds to zero and 002 to unit) shared by the two users which can be used as a key. The prob- 
ability of an error (e.g., obtaining zero instead of unit) is negligibly small if 80012 > 3(cri -|- (J2). 
To correct the key one can use a privacy amplification scheme proposed by Bennett et al [11]. 

Measurements where short pulses were used (i.e., the photon emission and registration 
times are known with high accuracy) allow to detect any eavesdropping attempt. For all 
such measurements users A and B announce through a public channel the photon emission 
{tA) and registration {ts) times. Then the expected delay time tA — ts = const (to within 
Atoo ~ 1/coo — > 0) is calculated from the known line length. Any systematic deviation of 
tA — tb from the expected delay time means the presence of an eavesdropper. Indeed, to extract 
the information about the key, the eavesdropper should be able to distinguish between uji and 002 
(0 or 1); therefore, he should employ narrow-band photodetectors. Such measurements (as well 
as preparation of narrow-band signals centered around coi and 002 to be sent by the eavesdropper 
to user B) cannot be performed faster than in Ati2 ~ I/SLO12 ^ A^oo- The eavesdropper will 
unavoidably run into the situation where user A sent a short signal, while the eavesdropper uses 
a narrow-band photodctector (since the user A chooses the type of signal he sends to user B at 
random) and re-sends to user B a signal with a well-defined frequency. The eaves dropper must 
re-send the photon to user B since otherwise this measurement will be discarded because the 
photodctector would not fire. Therefore, a systematic deviation oi tA — ts from the expected 
delay time by not less than Ati2 ~ l/5ooi2, which is much larger than the accuracy with which 
the delay time tA — tB is known. 
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Up to this moment we did not take into account attenuation and dispersion of the quantum 
communication channel. Practically, a fiber cable is used as channel which implies that short 
pulses sent by user A would experience broadening (signal width at the receiving end of the 
line is expected to be enhanced) so that the scatter in the photon registration time by user B 
is increased simphfying the task of the eavesdropper and reducing the cryptosystem security. 

Our purpose is find out the relationships between the single-photon states parameters ai^2, 
5cji 2, (Toe , and the communication channel attenuation and dispersion which still allow a secret 
key distribution procedure. 

Let the user A prepare a single-photon state at the input of the communication channel 
(point X — 0) with the spectral width a (which is one of o'i,2,oo) and the carry frequency uq (for 
definiteness we assume that cuo — (^1,2, although this is not essential) 

^(0'^) - (^^^ I - 2 I i-iu^t)du; (2) 

The effective pulse duration at the channel input is 

{AtAf = I {t-tf\E{0,t)\'dt=^, (3) 

roo 

/ t\E(0,t)fdt, 
Jo 

and its spectral width is 

/•oo 

(AuA?^ (u;-cjf\E(0,u;)\^du;^ay2, (4) 
Jo 

roo 

uJ^ / u;\E(0,u;)\^du;, 
Jo 

roo 

E{0,uj)^ E{0,t)exp{iujt)dt 
Jo 

Actually, even for a short pulse with t ~ 10~^^ s the spectral width is relatively small (carry 
frequency c^o ~ 10^^ s^^), so that only quadratic terms can be retained in the expansion of the 
wavevector as a function of frequency [12,13]: 

k{u;) ^ ko + a{u; — ujo) + P{u; — u^Y, (5) 

where a and (3 are generally complex constants, their real and imaginary parts describing 
dispersion and attenuation, respectively. Let us first assume that the attenuation is absent. 
The signal (2) at the point x (user B) takes the form 

/ X 1 1 { {otx-ty \ ^ I 



The field intensity observed by user B is 



ir^/ .m2 1 f {ciX-tY\ 2/ N (JQ+f5'^X^ ._. 



The effective spectral width of the signal at point x remains the same as at the channel input 
(remember that the attenuation is not taken into account) 

roo roo 

{AujAf = {AujbT = {uj-uf\E{0,u;)\^du;= {uu - U)^\E{x,u;)\^du; (8) 
Jo Jo 
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The effective pulse duration at the receiving end of the channel is increased by a factor of 
(1 + p^x^a") 

{AtBr = /^''(t-tri^(x,t)rcit=2^ = ^(l + /3Va^), (9) 

This time At^ is the mean time taken by the wave packet to pass through the point x, while 
the inequality 

AcuBAtB > vTT^2^ (10) 

is a variety of the Mandelstam-Tamm inequality [14]. Equation (10) describes the statistics 
of (potential) measurements performed on a particle, rather than an actual measurement of 
a photon observable so that it cannot be interpreted as a time-energy uncertainty relation 
relevant to a real act of measurement (which is described by the Bohr uncertainty principle; see 
a detailed discussion in the paper by Krylov and Fock [16]). We shall adhere to the orthodox 
point of view assuming the time-energy uncertainty relation is a fundamental law of nature 
(various point of view are discussed in a review article by Dodonov and Man'ko [17]). The 
average time taken by the wave packet to pass through the point x has nothing to do with the 
measurement time St which is arbitrarily chosen by the experimentalist. The Bohr uncertainty 
relation is applicable to a real act of measurement (e.g. passage of a particle through a device 
shutter which unavoidably changes the particle energy in an uncontrollable way) 

AEAt > 1, (11) 

where AE is the scatter of measured energy [17]. Unlike the Mandelstam-Tamm relation 
which is derived from the evolution governed by the Schrodinger equation [14], the Bohr un- 
certainty relation is actually a postulate since the measurement act cannot be described by the 
Schrodinger equation. 

Thus, to register a photon with the spectrum width (Too user B should open the shutter for 
a time interval at least (1 -|- (3'^x'^a'^y^'^ /aoo long. Of course, user B could open the shutter for 
arbitrarily short time, but in that case he would not be able to systematically detect a photon: 
Although in some rare measurements he would still register a photon even if the shutter were 
only open during dt ^ 0, the fraction of such measurements should tend to zero or otherwise 
the Bohr time-energy uncertainty relation [15] would be violated. 

Let us now find out when the quantum cryptosystem still remains secret, i.e. the scatter 
in the short pulse registration times by user B Ats should be substantially less than the time 
taken by the eavesdropper (at the location x somewhere between A and B) to register the 
photon with a narrow-band photodetector, which, as described above, could not be shorter 
than 

AtE > , ^ '-'^ (12) 

dUJi2 

The inequahty 

AtB < AtE (13) 
imposes the following limit on the channel length: 

(i + /3VO^/^ {I + P'xiai,y/' ^^^^ 

The worst situation with respect to the system secrecy occurs if the eavesdropper is located close 
to the user A (xg ~ 0). In that case the eavesdropper is not affected by the pulse broadening. 
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Therefore, the maximum channel length is 

XB < , ^ r, (15) 

Thus, the smaller is the frequency separation between the information-carrying signals lo\ and 
L02i the shorter is the reference pulse (the wider is its frequency spectrum), and the lower is 
the dispersion quadratic coefficient, the larger is the allowed quantum communication channel 
length still preserving the system secrecy. However, this inequality does not impose any absolute 
restrictions on the channel length. Formally, the channel length can be made arbitrarily large 
at the price of reducing the frequency separation ^loyl = |<^i — ^2!- 

Let us now make some numerical estimates. For a frequency separation (5a;i2 = |a;i — a;2| ~ 
10^ Hz corresponding to the linewidth of a rather average semiconductor laser, the short pulse 
duration of 1 ps [ooq ~ 10^^ Hz), and a typical quadratic dispersion coefficient /3 ~ 1 ps^/km 
[18], one has for the allowed channel length 

< . 1012"^. (10-12)2 M ~ 10' km. 

The role of attenuation reduces to the following two effects. First, the fraction of measure- 
ments where the photodetector employed by user B did not fire is increased. This effect reduces 
the system efficiency but does not affect its secrecy. The second effect is the renormalization 
of dispersion. Now the restriction on the channel length becomes 

(1 + ai,^i^xf + ^l^x^aj:, ago . . 

(l + <T^An.^)^ -<^C^12' ^ ^ 

for weak attenuation 

XB < I , (17) 

V/^L + /^re<^^12(7oo 

where j3re and j3im are the real and imaginary parts of the dispersion quadratic coefficient. 
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